In total, ministers have listed 17 countries for failing to meet agreed tax good governance standards. In addition, 47 countries have committed to addressing deficiencies in their tax systems and to meet the required criteria, following contacts with the EU.

This unprecedented exercise should raise the level of tax good governance globally and help prevent the large-scale tax abuse exposed in recent scandals such as the “Paradise Papers”.

Pierre Moscovici, Commissioner for Economic and Financial Affairs, Taxation and Customs, said: “The adoption of the first ever EU blacklist of tax havens marks a key victory for transparency and fairness. But the process does not stop here. We must intensify the pressure on listed countries to change their ways. Blacklisted jurisdictions must face consequences in the form of dissuasive sanctions, while those that have made commitments must follow up on them quickly and credibly. There must be no naivety: promises must be turned into actions. No one must get a free pass.”

The idea of an EU list was originally conceived by the Commission and subsequently taken forward by Member States. Compilation of the list has prompted active engagement from many of the EU’s international partners. However, work must now continue as 47 more countries should meet EU criteria by the end of 2018, or 2019 for developing countries without financial centres, to avoid being listed. The Commission also expects Member States to continue towards strong and dissuasive countermeasures for listed jurisdictions which can complement the existing EU-level defensive measures related to funding.

Next Steps

The EU listing process is a dynamic one, which will continue into 2018:

• As a first step, a letter will be sent to all jurisdictions on the EU list, explaining the decision and what they can do to be de-listed.
• The Commission and Member States (in the Code of Conduct Group) will continue to monitor all jurisdictions closely, to ensure that commitments are fulfilled and to determine whether any other countries should be listed in the future. A first interim progress report should be published by mid-2018. The EU list will be updated at least once a year.

For more information see:

MEMO on the list of non-cooperative tax jurisdictions

FACTSHEET on the list of non-cooperative tax jurisdictions

The European Securities and Markets Authority (ESMA) is looking to newly constitute a Consultative Working Group (CWG) for the ESMA Corporate Finance Standing Committee (CFSC) as the two-year-term of the existing CWG will expire shortly. ESMA is therefore calling for expressions of interest from stakeholders by 5 January 2018 to become a member of the CWG.

The European Securities and Markets Authority (ESMA) is looking to newly constitute a Consultative Working Group (CWG) for the ESMA Corporate Finance Standing Committee (CFSC) as the two-year-term of the existing CWG will expire shortly. ESMA is therefore calling for expressions of interest from stakeholders by 5 January 2018 to become a member of the CWG.

4 December 2017

On 29 November 2017, the Federal Bureau of Investigation (FBI), in close cooperation with the Luneburg Central Criminal Investigation Inspectorate in Germany, Europol’s European Cybercrime Centre (EC3), the Joint Cybercrime Action Task Force (J-CAT), Eurojust and private-sector partners, dismantled one of the longest running malware families in existence called Andromeda (also known as Gamarue).

This widely distributed malware created a network of infected computers called the Andromeda botnet (1). According to Microsoft, Andromeda’s main goal was to distribute other malware families. Andromeda was associated with 80 malware families and, in the last six months, it was detected on or blocked an average of over 1 million machines every month. Andromeda was also used in the infamous Avalanche network, which was dismantled in a huge international cyber operation in 2016. Steven Wilson, the Head of Europol’s European Cybercrime Centre said: “This is another example of international law enforcement working together with industry partners to tackle the most significant cyber criminals and the dedicated infrastructure they use to distribute malware on a global scale. The clear message is that public-private partnerships can impact these criminals and make the internet safer for all of us.”

One year ago, on 30 November 2016, after more than four years of investigation, the Public Prosecutor’s Office Verden and the Luneburg Police in Germany, the United States Attorney’s Office for the Western District of Pennsylvania, the Department of Justice, the FBI, Europol, Eurojust and global partners, had dismantled the international criminal infrastructure Avalanche. This was used as a delivery platform to launch and manage mass global malware attacks such as Andromeda, and money mule recruitment campaigns.

Insights gained during the Avalanche case by the investigating German law enforcement entities were shared, via Europol, with the FBI and supported this year’s investigations to dismantle the Andromeda malware last week.

Jointly, the international partners took action against servers and domains, which were used to spread the Andromeda malware. Overall, 1500 domains of the malicious software were subject to sinkholing (2). According to Microsoft, during 48 hours of sinkholing, approximately 2 million unique Andromeda victim IP addresses from 223 countries were captured. The involved law enforcement authorities also executed the search and arrest of a suspect in Belarus. Simultaneously, the German sinkhole measures of the Avalanche case have been extended by another year. An extension of this measure was necessary, as globally 55 per cent of the computer systems originally infected in Avalanche are still infected today.

The measures to combat the malicious Andromeda software as well as the extension of the Avalanche measures involved the following EU Member States: Austria, Belgium, Finland, France, Italy, the Netherlands, Poland, Spain, the United Kingdom, and the following non-EU Member States: Australia, Belarus, Canada, Montenegro, Singapore and Taiwan.

The operation was supported by the following private and institutional partners: Shadowserver Foundation, Microsoft, Registrar of Last Resort, Internet Corporation for Assigned Names and Numbers (ICANN) and associated domain registries, Fraunhofer Institute for Communication, Information Processing and Ergonomics (FKIE), and the German Federal Office for Information Security (BSI).

The operation was coordinated from the command post hosted at Europol’s HQ.

1. Botnets are networks of computers infected with malware, which are under the control of a cybercriminal. Botnets allow criminals to harvest sensitive information from infected computers, such as online banking credentials and credit card information. A criminal can also use a botnet to perform cyberattacks on other computer systems, such as denial-of-service attacks.
2. Sinkholing is an action whereby traffic between infected computers and a criminal infrastructure is redirected to servers controlled by law enforcement authorities and/or an IT security company. This may be done by assuming control of the domains used by the criminals or IP addresses. When employed at a 100% scale, infected computers can no longer reach the criminal command-and-control computer systems and criminals can therefore no longer control the infected computers. The sinkholing infrastructure captures victims’ IP addresses, which can subsequently be used for notification and follow-up through dissemination to National CERTs and network owners.